makit/.github/workflows/server-ci.yml at 7a5613827c6f96914596f966a768790c0e94fe95 · leduckhc/makit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
name: Server Security + Lint CI

on:
  push:
    branches: [ main ]
    paths:
      - 'server/**'
      - '.github/workflows/server-ci.yml'
  pull_request:
    branches: [ main ]
    paths:
      - 'server/**'
      - '.github/workflows/server-ci.yml'

jobs:
  lint-and-typecheck:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: server

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Enable Corepack
        run: corepack enable

      - name: Prepare pnpm
        run: corepack prepare pnpm@11.8.0 --activate

      - name: Cache pnpm store
        uses: actions/cache@v5
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies (lockfile-locked)
        run: pnpm secure:install

      - name: Run typecheck
        run: pnpm typecheck

      - name: Build
        run: pnpm build

      - name: Verify pnpm-lock.yaml integrity
        run: |
          if ! git diff --exit-code pnpm-lock.yaml > /dev/null; then
            echo "ERROR: pnpm-lock.yaml would be modified by pnpm install"
            echo "This indicates a lockfile inconsistency or manual edit."
            echo "Run: pnpm install && git add pnpm-lock.yaml"
            exit 1
          fi

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    defaults:
      run:
        working-directory: server

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Enable Corepack
        run: corepack enable

      - name: Prepare pnpm
        run: corepack prepare pnpm@11.8.0 --activate

      - name: Cache pnpm store
        uses: actions/cache@v5
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm secure:install

      - name: Run tests
        run: pnpm test

  security-audit:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        working-directory: server

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: '22'

      - name: Enable Corepack
        run: corepack enable

      - name: Prepare pnpm
        run: corepack prepare pnpm@11.8.0 --activate

      - name: Cache pnpm store
        uses: actions/cache@v5
        with:
          path: ~/.local/share/pnpm/store
          key: ${{ runner.os }}-pnpm-${{ hashFiles('server/pnpm-lock.yaml') }}
          restore-keys: |
            ${{ runner.os }}-pnpm-

      - name: Install dependencies
        run: pnpm secure:install

      - name: Audit production dependencies
        run: pnpm secure:audit